Qureos Mentor

GovTech (Stealth)

SummaryCivicLock is an early-stage startup pre-raise and is hiring a hands-on security and infrastructure lead in Los Angeles County to take ownership of backend security, chain-of-custody integrity, cloud architecture, and compliance. You will work side by side with the founder, migrate control from a contractor environment to a CivicLock-owned stack, and build the foundation for SOC 2 and CJIS alignment. This is an in-person hybrid role in LA County.What you will own<ul><li>Control and access</li><li>Move all code and cloud assets into CivicLock-owned orgs. Enforce SSO, MFA, least-privilege IAM, and role-based access for staff and contractors.</li><li>Replace personal SSH keys with short-lived, auditable access via SSO, strong device posture, and per-repo deploy keys. All production changes through CI only.</li><li>Evidence security and chain of custody</li><li>Design and implement end-to-end hashing and receipts for every upload. Client and server SHA-256 hashing, signed manifests, immutable audit log, and time stamping.</li><li>Evidence storage hardening with KMS, S3 Object Lock WORM, lifecycle rules, and secure egress for prosecutor exports.</li><li>Cloud architecture</li><li>Stand up a multi-account AWS architecture with IaC. Separate dev, staging, prod. Private subnets, WAF, CloudTrail Lake, central logging, SIEM integration.</li><li>Secrets management with AWS KMS and Parameter Store or Vault. Key rotation policy and break-glass procedures.</li><li>App security and delivery</li><li>CI/CD with branch protections, CODEOWNERS, SAST, dependency scanning, container scanning, IaC scanning. Repeatable blue-green or canary deploys.</li><li>API security, rate limiting, request signing, and scoped presigned uploads.</li><li>Compliance and readiness</li><li>SOC 2 Type II readiness plan. Policies, risk register, asset inventory, vendor management, vulnerability management, incident response program.</li><li>CJIS alignment and a path to GovCloud where required, including personnel controls and logging controls.</li><li>Mentorship and enablement</li><li>Pair with the founder to explain choices, document runbooks, and level up internal capability. Light code reviews with backend vendors.</li></ul>Must have<ul><li>5+ years in DevSecOps or Security Engineering with production ownership of AWS stacks</li><li>Strong AWS IAM, VPC, KMS, S3 Object Lock, CloudFront, WAF, CloudTrail, GuardDuty</li><li>Terraform or Pulumi, GitHub Actions or similar CI/CD, Docker, container security</li><li>Proven delivery of SOC 2 readiness or certification and policy implementation</li><li>Designing immutable audit trails and cryptographic integrity workflows</li><li>Hardening workflows for external contractors and rotating secrets at scale</li><li>Excellent documentation and the ability to work on site in LA County several days per week</li><li>Willing to pass background screening suitable for handling law enforcement data</li></ul>Nice to have<ul><li>CJIS experience, NIST 800-53 moderate, FedRAMP concepts, or GovCloud migrations</li><li>Evidence or chain-of-custody systems, Merkle trees or tamper-evident logs</li><li>Postgres, Redis, SQS, Step Functions, EKS or Fargate</li><li>SSO and device posture enforcement with MDM</li></ul>Engagement<ul><li>Part-time: Contract-to-hire</li><li>Location: Los Angeles County, hybrid in person</li><li>Compensation: market-competitive base plus early equity. Open to senior or staff level depending on depth.</li></ul>Job Type: Part-timePay: $30.00 - $60.00 per hourExpected hours: 5 &ndash; 40 per weekWork Location: Hybrid remote in Santa Monica, CA 90401

Security & Infrastructure Engineer (DevSecOps)

Join GovTech (Stealth) and explore 1   exciting career opportunities. They're hiring for various roles with options for remote or on-site work. Apply today and become part of their innovative team.

GovTech (Stealth)

ABOUT_COMPANY

Security & Infrastructure Engineer (DevSecOps)